CVE-2026-100892
aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruption
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 28, 2026
- Updated
- Sep 28, 2026
- Reserved
- Sep 27, 2026
Description
A vulnerability was found in aligungr UERANSIM up to 3.3.0. This affects the function ULInformationTransfer of the file src/gnb/rrc/handler.cpp of the component nr-gnb. Performing a manipulation of the argument dedicatedNASMessage results in memory corruption. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-119 Memory Corruption
Affected Products
| Product | Versions |
|---|---|
UERANSIMaligungr |
|
References
- VDB-410842 | aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruptionvdb-entrytechnical-description
- VDB-410842 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-100892 | CVE Analysis and Reportthird-party-advisory
- Submit #917313 | UERAMSIM UERANSIM nr-gnb <=3.3.0 Denial-of-Servicthird-party-advisory
- https://gist.github.com/centauruszzz/c69a6bd152f45d9ca8db981f7da34bedexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.